Tainacan

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Tainacan

Information

Software Type Plugin
Software Slug tainacan (view on wordpress.org)
Software Status Active
Software Author tainacan
Software Website tainacan.org
Software Downloads 62,121
Software Active Installs 1,000
Software Record Last Updated July 10, 2026

17 Vulnerabilities

Submit a Vulnerability
Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
7.5
CVE-2026-6230
Jul 7, 2026
Researcher: daroo
Tainacan <= 1.0.3 - Unauthenticated SQL Injection
7.5
CVE-2026-42740
May 28, 2026
Researcher: hhhai
Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation
5.3
CVE-2025-14043
Dec 20, 2025
Researcher: Deadbee
Tainacan <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVE-2025-12746
Nov 20, 2025
Researcher: Deadbee
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
5.3
CVE-2025-12747
Nov 20, 2025
Researcher: Deadbee
Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion
5.3
CVE-2025-47512
May 16, 2025
Researcher: astra.r3verii
Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2024-13236
Jan 22, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Tainacan <= 0.21.10 - Reflected Cross-Site Scripting
6.1
CVE-2024-9221
Oct 10, 2024
Researcher: Colin Xu
Tainacan <= 0.21.8 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2024-48040
Oct 9, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
6.5
CVE-2024-7135
Jul 30, 2024
Researcher: 1337_Wannabe
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
6.4
CVE-2024-4367
May 20, 2024
Researchers: Colin Xu, James Myers (ConfidenceRemainsHigh), Codean Labs
Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-34794
May 20, 2024
Researcher: LVT-tholv2k
Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-34795
May 20, 2024
Researcher: LVT-tholv2k
Tainacan <= 0.20.7 - Missing Authorization
5.3
CVE-2024-30529
Mar 29, 2024
Researcher: Dhabaleshwar Das
Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-1435
Feb 26, 2024
Researcher: Peng Zhou
Tainacan <= 0.20.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-47848
Nov 20, 2023
Researcher: Dimas Maulana
Tainacan <= 0.18.9 - Cross-Site Scripting
7.2
CVE ID Unknown
May 24, 2022
Researchers:
Title Status CVE ID CVSS Researchers Date
Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter Patched CVE-2026-6230 7.5 daroo July 7, 2026
Tainacan <= 1.0.3 - Unauthenticated SQL Injection Patched CVE-2026-42740 7.5 hhhai May 28, 2026
Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation Patched CVE-2025-14043 5.3 Deadbee December 20, 2025
Tainacan <= 1.0.0 - Reflected Cross-Site Scripting Patched CVE-2025-12746 6.1 Deadbee November 20, 2025
Tainacan <= 1.0.0 - Unauthenticated Information Exposure Patched CVE-2025-12747 5.3 Deadbee November 20, 2025
Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion Patched CVE-2025-47512 5.3 astra.r3verii May 16, 2025
Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection Patched CVE-2024-13236 6.5 Trương Hữu Phúc (truonghuuphuc) January 22, 2025
Tainacan <= 0.21.10 - Reflected Cross-Site Scripting Patched CVE-2024-9221 6.1 Colin Xu October 10, 2024
Tainacan <= 0.21.8 - Authenticated (Subscriber+) SQL Injection Patched CVE-2024-48040 6.5 Trương Hữu Phúc (truonghuuphuc) October 9, 2024
Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read Patched CVE-2024-7135 6.5 1337_Wannabe July 30, 2024
PDF.js < 4.2.67 - Arbitrary JavaScript Execution Patched CVE-2024-4367 6.4 Colin Xu, James Myers (ConfidenceRemainsHigh), Codean Labs May 20, 2024
Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-34794 7.2 LVT-tholv2k May 20, 2024
Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-34795 6.4 LVT-tholv2k May 20, 2024
Tainacan <= 0.20.7 - Missing Authorization Patched CVE-2024-30529 5.3 Dhabaleshwar Das March 29, 2024
Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure Patched CVE-2024-1435 5.3 Peng Zhou February 26, 2024
Tainacan <= 0.20.4 - Reflected Cross-Site Scripting Patched CVE-2023-47848 6.1 Dimas Maulana November 20, 2023
Tainacan <= 0.18.9 - Cross-Site Scripting Patched 7.2 May 24, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation